Cloud Platform
Platform
Solutions
Resources
Customers
Partners
Community
Support
Company
Login
Contact us
Try it
Asset Management
Vulnerability & Configuration Management
Risk Remediation
Threat Detection & Response
  • Overview

  • Platform Apps

  • Qualys Endpoint Security

    Advanced endpoint threat protection, improved threat context, and alert prioritization

  • Context XDR

    Extend detection and response beyond the endpoint to the enterprise

Compliance
Cloud Security
Cyber Risk Series | Cloud Security Edition | February 28 | Register Now

Microsoft security alert.

April 10, 2018

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 71 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Edge Security Update for April 2018

    Severity
    Critical 4
    Qualys ID
    91443
    Vendor Reference
    KB4093107, KB4093109, KB4093111, KB4093112, KB4093119
    CVE Reference
    CVE-2018-0892, CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0993, CVE-2018-0994, CVE-2018-0995, CVE-2018-0998, CVE-2018-1019, CVE-2018-1023
    CVSS Scores
    Base 7.6 / Temporal 6
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4093109
    2) KB4093119
    3) KB4093107
    4) KB4088782
    5) KB4093111

    QID Detection Logic (Authenticated):
    Operating Systems: All versions of Windows 10 and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version is 11.0.10240.17831 (KB4093111)
    The patch version is 11.0.10586.1540(KB4093109)
    The patch version is 11.0.14393.2189(KB4093119)
    The patch version is 11.0.15063.1029(KB4093107)
    The patch version is 11.0.16299.371(KB4093112)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    2) Information Disclosure

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Internet Explorer Security Update for April 2018

    Severity
    Critical 4
    Qualys ID
    100334
    Vendor Reference
    KB4092946, KB4093107, KB4093109, KB4093111, KB4093112, KB4093114, KB4093118, KB4093119, KB4093123
    CVE Reference
    CVE-2018-0870, CVE-2018-0981, CVE-2018-0987, CVE-2018-0988, CVE-2018-0989, CVE-2018-0991, CVE-2018-0996, CVE-2018-0997, CVE-2018-1000, CVE-2018-1001, CVE-2018-1004, CVE-2018-1018, CVE-2018-1020
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11). The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the Update:
    1)4093118
    2)4092946
    3)4093109
    4)4093114
    5)4093119
    6)4093111
    7)4093107
    8)4093112
    9)4093123

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version is 11.0.9600.18978 (KB4093118 or KB4092946 or KB4093114)
    The patch version is 11.0.10240.17831 (KB4093111)
    The patch version is 11.0.10586.1540 (KB4093109)
    The patch version is 11.0.14393.2189 (KB4093119)
    The patch version is 11.0.15063.1029 (KB4093107)
    The patch version is 11.0.16299.371(KB4093112)
    The patch version is 10.0.9200.22411 (KB4092946 or KB4093123)
    The patch version is 9.0.8112.21213 (KB4092946)

    Consequence
    Successful exploitation of the vulnerability will lead to:

    1) Remote Code Execution
    2) Information Disclosure

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update April 2018

    Severity
    Critical 4
    Qualys ID
    110316
    Vendor Reference
    KB4011586, KB4011628, KB4011712, KB4011717, KB4011719, KB4018288, KB4018311, KB4018319, KB4018328, KB4018330, KB4018336, KB4018337, KB4018339, KB4018341, KB4018342, KB4018343, KB4018344, KB4018347, KB4018350, KB4018353, KB4018354, KB4018355, KB4018356, KB4018357, KB4018359, KB4018360, KB4018362
    CVE Reference
    CVE-2018-0920, CVE-2018-0950, CVE-2018-1005, CVE-2018-1007, CVE-2018-1011, CVE-2018-1014, CVE-2018-1026, CVE-2018-1027, CVE-2018-1028, CVE-2018-1029, CVE-2018-1030, CVE-2018-1032, CVE-2018-1034
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft releases security updates on April 2018 to fix multiple security vulnerabilities:

    This security updates contain following KBs:
    KB4011586 KB4011628 KB4011712 KB4011717 KB4011719 KB4018288 KB4018311 KB4018319 KB4018328 KB4018330 KB4018336 KB4018337 KB4018339 KB4018341 KB4018342 KB4018343 KB4018344 KB4018347 KB4018350 KB4018353 KB4018354 KB4018355 KB4018356 KB4018357 KB4018359 KB4018360 KB4018362 QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update April 2018(Office)

  • Microsoft Visual Studio Security Update for April 2018

    Severity
    Critical 4
    Qualys ID
    91442
    Vendor Reference
    CVE-2018-1037
    CVE Reference
    CVE-2018-1037
    CVSS Scores
    Base 4.3 / Temporal 3.2
    Description
    An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database (PDB) files. To take advantage of the vulnerability, an attacker would require access to an affected PDB file created using a vulnerable version of Visual Studio. An attacker would have no way to force a developer to produce this information disclosure. The security update addresses the vulnerability by correcting how PDB files are generated when a project is compiled.

    Affected Software:
    Microsoft Visual Studio 2010 Service Pack 1
    Microsoft Visual Studio 2012 Update 4
    Microsoft Visual Studio 2013 Update 5
    Microsoft Visual Studio 2015 Update 3
    Microsoft Visual Studio 2017
    Microsoft Visual Studio 2017 Version 15.6.6
    Microsoft Visual Studio 2017 Version 15.7 Preview

    QID Detection Logic:
    This authenticated QID verifies the file versions of mspdbcore.dll from the following registry entries:
    HKLM\SOFTWARE\Microsoft\VisualStudio.0\InstallDir
    HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio.0\InstallDir
    HKLM\SOFTWARE\Microsoft\VisualStudio.0\InstallDir
    HKLM\SOFTWARE\Wow6432Node\Microsoft\VisualStudio.0\InstallDir

    NOTE: As of now, this QID does not check for Microsoft Visual Studio 2017 patches.

    Consequence
    An attacker who took advantage of this information disclosure could view uninitialized memory from the Visual Studio instance used to compile the PDB file.
    Solution
    Customers are advised to refer to CVE-2018-1037 for updates pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2018-1037

  • Microsoft Windows Adobe Flash Player Security Update for April 2018 (ADV180007)

    Severity
    Urgent 5
    Qualys ID
    100333
    Vendor Reference
    ADV180007
    CVE Reference
    CVE-2018-4932, CVE-2018-4933, CVE-2018-4934, CVE-2018-4935, CVE-2018-4936, CVE-2018-4937
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB18-08, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 Version 1709, Windows 8.1, or Windows RT 8.1.

    QID Detection Logic:
    Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 29.0.0.140.

    KB Articles associated with this update are: ADV180007

    Consequence
    Successful exploitation allows an attacker to execute code remotely and bypass security restrictions to gain access to sensitive information.
    Solution
    Customers are advised to follow KB4093110 for instructions pertaining to the remediation of these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4093110

  • Microsoft Windows Security Update April 2018

    Severity
    Critical 4
    Qualys ID
    91441
    Vendor Reference
    KB4091756, KB4093107, KB4093108, KB4093109, KB4093111, KB4093112, KB4093114, KB4093115, KB4093118, KB4093119, KB4093122, KB4093123, KB4093223, KB4093224, KB4093227, KB4093257, KB4093478, KB4100480
    CVE Reference
    CVE-2018-0887, CVE-2018-0890, CVE-2018-0956, CVE-2018-0957, CVE-2018-0960, CVE-2018-0963, CVE-2018-0964, CVE-2018-0966, CVE-2018-0967, CVE-2018-0968, CVE-2018-0969, CVE-2018-0970, CVE-2018-0971, CVE-2018-0972, CVE-2018-0973, CVE-2018-0974, CVE-2018-0975, CVE-2018-0976, CVE-2018-1003, CVE-2018-1004, CVE-2018-1008, CVE-2018-1009, CVE-2018-1010, CVE-2018-1012, CVE-2018-1013, CVE-2018-1015, CVE-2018-1016, CVE-2018-1038, CVE-2018-8116
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. (CVE-2018-1038)
    An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address. (CVE-2018-0887)
    A security feature bypass vulnerability exists when Active Directory incorrectly applies Network Isolation settings. To exploit this vulnerability, an attacker could run a specially crafted application. (CVE-2018-0890)
    A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests. (CVE-2018-0956)
    An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0957)
    An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory.(CVE-2018-0960)

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for following file versions %windir%\System32\Win32k.sys for all affected OS except Windows 10 and Windows 16:
    The patch version of 6.0.6002.24344 (KB4093224)
    The patch version of 6.1.7601.24093 (KB4093108 or KB4093118)
    The patch version of 6.2.9200.22413 (KB4093122 or KB4093123)
    The patch version of 6.3.9600.18979 (KB4093114 or KB4093115)

    This QID checks for following file versions %windir%\System32\Win32kfull.sys.exe for Windows 10 and Windows 16:
    The patch version of 10.0.10240.17831 (KB4093111)
    The patch version of 10.0.10586.1540 (KB4093109)
    The patch version of 10.0.14393.2189 (KB4093119)
    The patch version of 10.0.15063.1029 (KB4093107)
    The patch version of 10.0.16299.371 (KB4093112)

    This QID checks for following files and its versions for Windows 2008 SP2:
    The patch version of %windir%\System32\Advapi32.dll 6.0.6002.24335 (KB4093478)
    The patch version of %windir%\System32\Msexcl40.dll 4.0.9801.3 (KB4093257)
    The patch version of %windir%\system32\Atmfd.dll 5.1.2.253 (KB4093223)
    The patch version of %windir%\System32\Basecsp.dll 6.0.6002.24329 (KB4093227)
    The patch version of %windir%\system32\Wsnmp32.dll 6.0.6002.24398 (KB4091756)

    Note: KB4091756 was re-released on June 12, 2018 for Windows Server 2008 SP2

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4091756
    KB4093107
    KB4093108
    KB4093109
    KB4093111
    KB4093112
    KB4093114
    KB4093115
    KB4093118
    KB4093119
    KB4093122
    KB4093123
    KB4093223
    KB4093224
    KB4093227
    KB4093257
    KB4093478
    KB4100480

These new vulnerability checks are included in Qualys vulnerability signature 2.4.304-5. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 91443
    • 100334
    • 110316
    • 91442
    • 100333
    • 91441
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.